Name: Multiple SQL Injection vulnerabilities in Disk Pool Manager (DPM) Author: Adam Zabrocki (<pi3 () pi3 com pl>) Date: November 27, 2009 (Yes, it's very old bug ;P) Description: LCG Disk Pool Manager (DPM) has been developed as part of the LCG project to provide a light-weight implementation of an SRM compliant Storage Element (SE). Since gLite 3.0 it is a standard gLite component, distributed and maintained as part of the gLite release. It has been developed at European Organization for Nuclear Research (CERN). DPM is a disk only SE, instead of a disk + MSS implementation like dCache or Castor. It may act as a replacement for the deprecated classic SE with the following advantages : - SRM interface (both v1.1 and v2.2) - Better scalability : DPM is allow to manage 100+ TB distributing the load over several servers - High performances - Light-weight management DPM is commonly used in most of the GRID projects including CERN WLCG, EGEE, ..., etc. Details: A multiple SQL Injection vulnerability has been found in Disk Pool Manager (DPM). Please read following details: "./srmv2.2/srmv2_xferreq.c" int ns1__srmGetRequestSummary (struct soap *soap, struct ns1__srmGetRequestSummaryRequest *req, struct ns1__srmGetRequestSummaryResponse_ *rep) { ... char *r_token; ... ... ... for (i = 0; i < nbtokens; i++) { ... r_token = req->arrayOfRequestTokens->stringArray[i]; if (strlen (r_token) > CA_MAXDPMTOKENLEN) { reptokenp->status->statusCode = SRM_USCOREINVALID_USCOREREQUEST; reptokenp->status->explanation = soap_strdup (soap, "Invalid request token"); nb_errors++; continue; } if (dpm_getonereqsummary (thip, r_token, &r_type, &r_status, &nbreqfiles, &nb_queued, &nb_progress, &nb_failed) < 0) { ... ... } ... ... } ... ... } This function is responsible fo reading and parsing requests. If length of "r_token" variable is not greather than CA_MAXDPMTOKENLEN function dpm_getonereqsummary() is called: "dpm/dpm_procsubr.c" dpm_getonereqsummary (thip, r_token, r_type, r_status, nbreqfiles, nb_queued, nb_progress, nb_failed) struct dpm_srv_thread_info *thip; char *r_token; char *r_type; int *r_status; int *nbreqfiles; int *nb_queued; int *nb_progress; int *nb_failed; { ... ... if (dpm_get_pending_req_by_token (&thip->dbfd, r_token, &dpm_req, 0, NULL) < 0 && dpm_get_req_by_token (&thip->dbfd, r_token, &dpm_req, 0, NULL) < 0) return (-1); ... ... } ... and: "dpm/dpm_mysql_ifce.c" dpm_get_pending_req_by_token(dbfd, r_token, dpm_req, lock, rec_addr) struct dpm_dbfd *dbfd; char *r_token; struct dpm_req *dpm_req; int lock; dpm_dbrec_addr *rec_addr; { char func[29]; static char query[] = "SELECT \ R_ORDINAL, R_TOKEN, R_UID, \ R_GID, CLIENT_DN, CLIENTHOST, \ R_TYPE, U_TOKEN, \ FLAGS, RETRYTIME, NBREQFILES, \ CTIME, STIME, ETIME, \ STATUS, ERRSTRING, GROUPS \ FROM dpm_pending_req \ WHERE r_token = '%s'"; static char query4upd[] = "SELECT ROWID, \ R_ORDINAL, R_TOKEN, R_UID, \ R_GID, CLIENT_DN, CLIENTHOST, \ R_TYPE, U_TOKEN, \ FLAGS, RETRYTIME, NBREQFILES, \ CTIME, STIME, ETIME, \ STATUS, ERRSTRING, GROUPS \ FROM dpm_pending_req \ WHERE r_token = '%s' \ FOR UPDATE"; MYSQL_RES *res; MYSQL_ROW row; char sql_stmt[1024]; MYSQL_RES *res; MYSQL_ROW row; char sql_stmt[1024]; strcpy (func, "dpm_get_pending_req_by_token"); sprintf (sql_stmt, lock ? query4upd : query, r_token); if (dpm_exec_query (func, dbfd, sql_stmt, &res)) return (-1); ... ... } This function creates a query to the MySQL Database - DPM supports three different databases: MySQL, PostgreSQL and Oracle. In this advisory I'm focused on MySQL database. This vulnerability may be in all supported databases. I haven't analyzed all the code. Variable 'r_token' isn't verified at all so SQL Injection attack is possible. Anyone with a certificate from a recognised CA can access the SRM interface so it is a serious vulnerability. SQL Injection exists not only in dpm_get_pending_req_by_token() function. Please read following list of functions which don't check inputs too: Function dpm_get_cpr_by_fullid() doesn't check 'r_token' Function dpm_get_cpr_by_surl() doesn't check 'r_token', 'surl' Function dpm_get_cpr_by_surls() doesn't check 'r_token', 'to_surl' Function dpm_get_gfr_by_fullid() doesn't check 'r_token' Function dpm_get_gfr_by_surl() doesn't check 'r_token' Function dpm_get_pending_req_by_token() doesn't check 'r_token' Function dpm_get_pending_reqs_by_u_desc() doesn't check 'u_token' Function dpm_get_pfr_by_fullid() doesn't check 'r_token' Function dpm_get_pfr_by_surl() doesn't check 'r_token' Function dpm_get_pool_entry() doesn't check 'poolname' variable but admin required so it isn't important. Function dpm_get_req_by_token() doesn't check 'r_token' Function dpm_get_reqs_by_u_desc() doesn't check 'u_token' Function dpm_get_spcmd_by_token() doesn't check 's_token' Function dpm_get_spcmd_by_u_desc() doesn't check 'u_token' Function dpm_insert_cpr_entry() doesn't check variable 's_token', 'r_token'. Function dpm_insert_fs_entry() doesn't check 'poolname' variable but admin required so it isn't important. Function dpm_insert_gfr_entry() doesn't check variable 's_token', 'r_token'. Function dpm_insert_pending_entry() doesn't check variable 'u_token', 'r_token'. Function dpm_insert_pfr_entry() doesn't check variable 's_token', 'r_token'. Function dpm_insert_pool_entry() doesn't check 'poolname' variable but admin required so it isn't important. Function dpm_insert_spcmd_entry() doesn't check variable 's_token', 'u_token' and (not important) 'poolname' - admin required. Functino dpm_insert_xferreq_entry() doesn't check variable 'u_token', 'r_token'. Function dpm_list_cpr_entry() doesn't check 'r_token' Functino dpm_list_fs_entry() doesn't check 'poolname' variable but admin required so it isn't important. Function dpm_list_gfr_entry() doesn't check 'r_token' Function dpm_list_pfr_entry() doesn't check 'r_token' Function dpm_update_cpr_entry() doesn't check 's_token' Function dpm_update_gfr_entry() doesn't check 's_token' Function dpm_update_pfr_entry() doesn't check 's_token' Function dpm_update_spcmd_entry() doesn't check 'poolname' variable but admin required so it isn't important. Proof of concept $ ./srm2_testGetRequestStatus srm://vmgdda0013.cern.ch:8446/ \' request status SRM_FAILURE request state 1 explanation: Failed for all tokens request summaryArray 1 ======= Begin Request ======== Request token: ' state[0]: 14 SRM_INTERNAL_ERROR $ Please read following dump of SRM log file: 07/23 18:01:50.330 9720,0 dpm_get_pending_req_by_token: mysql_query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1 07/23 18:01:50.330 9720,0 dpm_get_req_by_token: mysql_query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1 07/23 18:01:50.330 9720,0 GetRequestSummary: returns 0, statusCode=SRM_FAILURE Here is strace output from the SRMv2.2 process: poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout) write(7, "\335\0\0\0\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID, CLIENT_DN, CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME, NBREQFILES, \t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS \t\tFROM dpm_pending_req \t\tWHERE r_token = '''", 225) = 225 read(7, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1", 16384) = 162 gettimeofday({1311434508, 295920}, NULL) = 0 open("/var/log/srmv2.2/log", O_WRONLY|O_CREAT|O_APPEND, 0664) = 8 write(8, "07/23 17:21:48.295 9720,0 dpm_get_pending_req_by_token: mysql_query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1\n", 226) = 226 close(8) = 0 poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout) write(7, "\325\0\0\0\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID, CLIENT_DN, CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME, NBREQFILES, \t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS \t\tFROM dpm_req \t\tWHERE r_token = '''", 217) = 217 read(7, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1", 16384) = 162 gettimeofday({1311434508, 296597}, NULL) = 0 open("/var/log/srmv2.2/log", O_WRONLY|O_CREAT|O_APPEND, 0664) = 8 write(8, "07/23 17:21:48.296 9720,0 dpm_get_req_by_token: mysql_query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use nea r ''''' at line 1\n", 218) = 218 close(8) = 0 gettimeofday({1311434508, 296942}, NULL) = 0 open("/var/log/srmv2.2/log", O_WRONLY|O_CREAT|O_APPEND, 0664) = 8 write(8, "07/23 17:21:48.296 9720,0 GetRequestSummary: returns 0, statusCode=SRM_FAILURE\n", 80) = 80 close(8) = 0 And here is strace from the MySQL process: read(31, "\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID, CLIENT_DN , CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME, NBREQFILES, \t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS \t\tFROM dpm_pending_req \t\tWHERE r_token = '''", 221) = 221 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM TERM TSTP], 8) = 0 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP], NULL, 8) = 0 fcntl(31, F_SETFL, O_RDWR|O_NONBLOCK) = 0 time([1311436910]) = 1311436910 sched_setscheduler(15280, SCHED_OTHER, { 6 }) = -1 EINVAL (Invalid argument) sched_setscheduler(15280, SCHED_OTHER, { 8 }) = -1 EINVAL (Invalid argument) write(31, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1", 162) = 162 time([1311436910]) = 1311436910 read(31, 0x1f7ae9b0, 4) = -1 EAGAIN (Resource temporarily unavailable) time(NULL) = 1311436910 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM TERM TSTP], 8) = 0 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP], NULL, 8) = 0 fcntl(31, F_SETFL, O_RDWR) = 0 read(31, "\325\0\0\0", 4) = 4 read(31, "\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID, CLIENT_DN , CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME, NBREQFILES, \t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS \t\tFROM dpm_req \t\tWHERE r_token = '''", 213) = 213 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM TERM TSTP], 8) = 0 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP], NULL, 8) = 0 fcntl(31, F_SETFL, O_RDWR|O_NONBLOCK) = 0 time([1311436910]) = 1311436910 sched_setscheduler(15280, SCHED_OTHER, { 6 }) = -1 EINVAL (Invalid argument) sched_setscheduler(15280, SCHED_OTHER, { 8 }) = -1 EINVAL (Invalid argument) write(31, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1", 162) = 162 time([1311436910]) = 1311436910 read(31, 0x1f7ae9b0, 4) = -1 EAGAIN (Resource temporarily unavailable) Affected Software: All versions of Disk Pool Manager (DPM) below 1.8.6 version are affected. 1.8.6 was released 19th of February 2013. Greets +) David Smith - for testing infrastructures and other helps not only at this topic. References 1) https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2012-2683 2) http://site.pi3.com.pl/adv/disk_pool_manager_1.txt 3) http://blog.pi3.com.pl/?p=402 Timeline 2009-11-27 - Found vulnerability. 2011-08-03 - Vulnerability officialy reported. 2013-02-19 - Updated packages available in the EGI UMD-1 and EGI UMD-2. 2013-03-05 - Public disclosure on vendor's wiki, after allowing sites to upgrade (https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2012-2683) 2013-03-10 - Release of this advisory. Best regards, Adam Zabrocki -- http://pi3.com.pl